External DocumentationTo learn more, visit the Rapid7 InsightIDR documentation.
Parameters
| Parameter | Description |
|---|---|
| Alert RRN | The unique identifier of the alert to update, can be obtained using List Alerts action. |
| Assignee ID | The ID of the user to assign to the alert. |
| Comment | The reason for updating the alert, which is captured in the alert audit log for tracking purposes. |
| Disposition | The disposition of the alert. |
| Investigation RRN | The unique identifier of the investigation to attach the alert to. |
| Priority | The priority of the alert. |
| Status | The status of the alert. |
| Tags | Select whether to add or remove tags from the alert. |
| Tags Value | A comma-separated list of tags to add/remove from the alert. |
Example Output
{
"rrn": "string",
"version": 0,
"created_at": "2019-08-24T14:15:22Z",
"updated_at": "2019-08-24T14:15:22Z",
"alerted_at": "2019-08-24T14:15:22Z",
"ingested_at": "2019-08-24T14:15:22Z",
"external_source": "string",
"external_id": "string",
"organization": {
"id": "string",
"name": "string",
"region": "string",
"product_token": "string",
"customer_id": "string",
"customer_name": "string",
"customer_code": "string",
"customer_group": "string",
"flags": [
"string"
]
},
"title": "string",
"type": "string",
"rule": {
"rrn": "string",
"name": "string",
"mitre_tcodes": [
"string"
],
"version_rrn": "string"
},
"rule_matching_keys": [
{
"key": "string",
"values": [
"string"
]
}
],
"rule_keys_of_interest": [
{
"key": "string",
"values": [
"string"
]
}
],
"responsibility": "UNMAPPED",
"monitored": true,
"assignee": {
"at": "2019-08-24T14:15:22Z",
"id": "string",
"email": "string",
"first_name": "string",
"last_name": "string"
},
"priority": "UNMAPPED",
"status": "UNMAPPED",
"status_transitions": {
"seconds_to_first_investigating": 0,
"seconds_to_first_closed": 0,
"first_closed_at": "2019-08-24T14:15:22Z"
},
"disposition": "UNMAPPED",
"investigation_rrn": "string",
"tags": [
"string"
],
"permissions": {
"canEdit": true
},
"fields": [
{
"id": "string",
"values": [
"string"
]
}
],
"analytics": {
"analytics_is_novel": true,
"analytics_novel_score": 0.1,
"analytics_cluster_malicious": 0.1,
"analytics_cluster_testing": 0.1,
"analytics_pac": "string"
},
"due_date": "2019-08-24T14:15:22Z",
"first_closed_at": "2019-08-24T14:15:22Z",
"log_details": [
{
"log_id": "string",
"logset_id": "string",
"log_timestamp": 0,
"log_entry_id": "string"
}
],
"ai_suggested_disposition": "UNMAPPED",
"prediction_metadata": {
"property1": {},
"property2": {}
},
"prediction_data": {
"property1": {},
"property2": {}
}
}
Workflow Library Example
Update Alert with Rapid7 Insightidr and Send Results Via Email